Should business logic attack be one of the testing methods during pentesting or vulnerability assessment project?

Business logic attacks most of the time are left out during pentesting either it was not mentioned or are not aware about it.

Logic attacks is a manual process and most tools cannot examine logic.


Business logic attack is more like a "business logic testing" which is normally done before launching the application by the developer team (more preciously, the Quality Assurance team) of the application.

Before performing in a production level, an application must have gone through business logic testing. Though, there is still rooms for putting "Business logic attack" into vulnerability assessment checklist specially when the application is running for financial organization.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.